WordPress Core Path Traversal CVE-2026-87902 Moves From Probe to Code Execution

NEW YORK - Defenders are treating a critical WordPress Core path traversal as an active exploitation event after scanners moved within a day from reconnaissance probes to attempts that write attacker-controlled PHP files to disk. The flaw is tracked as CVE-2026-87902. It is not listed in the U.S. Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog as of this writing.

WordPress disclosed the issue on September 22, 2026, in advisory GHSA-7hp8-65ch-5whp and shipped fixes in version 7.1.2, with backports through maintained branches down to 4.7.37. The vendor describes an unauthenticated defect in get_page_template() page-template resolution that can include a chosen readable local .php file outside the active theme directories. When theme and server preconditions are met, that inclusion can lead to remote code execution. WordPress rates the issue 9.2 on CVSS v4.0. Successful RCE typically requires an active theme with a top-level directory whose name starts with page- (for example page-templates) and a readable local target such as pearcmd.php when PHP register_argc_argv is enabled. WordPress notes that the official PHP Docker image and default cPanel configurations running PHP before 8.5 are among environments where that setting is often on.

Patchstack reported that the first exploitation attempts against sites it protects arrived at 11:49 UTC on September 22, 2026, the same day the patch shipped, with payloads matching encodings addressed by the fix. An update published September 23 said traffic rose more than tenfold and progressed through three stages: inclusion of ordinary core files to confirm vulnerability, pearcmd.php checks with config-show when register_argc_argv is enabled, and config-create requests that write PHP content under /tmp or /var/tmp. Observed drop names include wp-pear-rce-flag.php, poc87902.php, luci_.php, and zeta_.php. Patchstack also reported nuclei and named proof-of-concept user agents in the traffic and said some payloads write shell-executing tags rather than harmless markers. Previdian told The Hacker News it recorded exploitation attempts against honeypots beginning September 23, including pearcmd paths and follow-on inclusion of a GitHub-hosted uploader script, while noting that default WordPress auto-updates may limit successful mass compromise.

For security operations and incident response teams, treat internet-facing or poorly isolated WordPress estates as a patch-and-hunt case, not only a CMS update ticket. Priority work is inventory of versions below 7.1.2 (or the matching backport on older branches), urgent upgrade, and log hunts for pagename values containing encoded traversal sequences such as %2e%2e or %252e%252e, paired page_id and pagename on the site root or /index.php, pearcmd, config-show, or config-create strings, and the scanning user agents Patchstack published. On hosts, check /tmp and /var/tmp for unexpected .php files matching the names above. Patchstack advises that a successful stage-three write means treat the host as compromised. Temporary hardening includes rejecting traversal sequences in pagename and disabling register_argc_argv to break the pearcmd chain until patched. Releases older than 4.6 will not receive a backport and require an upgrade path.